Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for automatic beacons in cross-origin subframes #904

Merged
merged 6 commits into from
Jan 12, 2024
Merged

Add support for automatic beacons in cross-origin subframes #904

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6d02107
add explainer for cross origin subframe beacons
blu25 Nov 13, 2023
e271559
rename variable
blu25 Nov 22, 2023
69330c4
add sentence about ancestor behavior
blu25 Dec 7, 2023
e8a7b4b
Update Fenced_Frames_Ads_Reporting.md
blu25 Dec 18, 2023
0332d57
address review comments
blu25 Jan 3, 2024
8b98b23
clarify sentence
blu25 Jan 5, 2024
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
address review comments
  • Loading branch information
@blu25
blu25 committed Jan 3, 2024
commit 0332d57c2b9b49060f4fce8a43af0e877abbb22c
4 changes: 2 additions & 2 deletions Fenced_Frames_Ads_Reporting.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,7 +283,7 @@ window.fence.setReportEventDataForAutomaticBeacons({

blu25 marked this conversation as resolved.
Show resolved Hide resolved
#### Credentials in Beacons

When 3rd party cookies are enabled, automatic beacon requests only (not beacons sent manually through `reportEvent`) allow credentials (cookies) to be set in headers. This was requested by https://github.com/WICG/turtledove/issues/866 in order to help with migration and ARA debugging. These requests are subject to CORS and only occur after opt-in by virtue of calling the `setReportEventDataForAutomaticBeacons` API.
When 3rd party cookies are enabled, automatic beacon requests only (not beacons sent manually through `reportEvent`) allow credentials (cookies) to be set in headers. This was requested by https://github.com/WICG/turtledove/issues/866 in order to help with migration and ARA debugging. These requests are subject to CORS and only occur after opt-in by virtue of calling the `setReportEventDataForAutomaticBeacons` API or using the `Allow-Fenced-Frame-Automatic-Beacons: true` response header in cross-origin iframes/component ad frames.

#### Enrollment Requirement
The reporting destination URL registered by `setReportEventDataForAutomaticBeacons` is required to have its [site](https://html.spec.whatwg.org/multipage/browsers.html#obtain-a-site) (scheme, eTLD+1) attested for Protected Audience API, otherwise the automatic beacon is not allowed to be sent to this reporting destination. Please see [the Privacy Sandbox enrollment attestation model](https://github.com/privacysandbox/attestation#the-privacy-sandbox-enrollment-attestation-model).
Expand All @@ -303,7 +303,7 @@ For fenced frames rendering the ad components under the top-level ad fenced fram
* Invocation of the `reportEvent` API from an ad component fenced frame is disallowed.
* The only supported beacons to be sent from an ad component fenced frame are the `reserved.top_navigation_start` and `reserved.top_navigation_commit` automatic beacons. Note these beacons are gated on a user activation (e.g. click).
* To ensure that there is no arbitrary data that can be received at the server from the component ad, the `eventData` field via `window.fence.setReportEventDataForAutomaticBeacons`, if specified, will be ignored. This ensures that information from the component ad URL is not revealed in the event report, or else it could lead to the join of two independently k-anonymous URLs (parent and component ad) at the receiving server.
* Automatic beacons will be sent from a component fenced frame (with no event data) when there is a user activation (e.g. click) on the ad component fenced frame, which results in a top-level navigation. The ad component must still opt in using the `Allow-Fenced-Frame-Automatic-Beacons: true` response header before the beacon can send.
* Automatic beacons will be sent from a component fenced frame (with no event data) when there is a user activation (e.g. click) on the ad component fenced frame, which results in a top-level navigation. The ad component must still opt in using the `Allow-Fenced-Frame-Automatic-Beacons: true` response header or invoking `setReportEventDataForAutomaticBeacons` before the beacon can send.

```
window.fence.setReportEventDataForAutomaticBeacons({
Expand Down